Pre-investor-demo AI security check
What middleBrick covers
- Pre-investor-demo AI endpoint security validation
- 18 adversarial AI security probes across scan tiers
- OpenAPI 3.0/3.1 and Swagger 2.0 with $ref resolution
- Authenticated scanning with domain verification gate
- Mapped findings to OWASP API Top 10, PCI-DSS 4.0, SOC 2
- CI/CD integration via GitHub Action and CLI output
Pre-investor demo AI security check
An investor demo showcases live features, integrations, and data views. If the API serving the demo exposes AI-related endpoints without proper controls, an attacker can extract system prompts, alter instructions, or trigger data exfiltration. A pre-investor-demo check validates the AI security posture of these endpoints before the demo is shared, reducing the risk of public exposure of internal logic or sensitive training details.
What teams get wrong when skipping this check
Teams often focus on functionality and uptime, deferring security until a later phase. Without a pre-demo review, common AI security mistakes appear in production-facing endpoints, including missing guardrails for prompt injection, token smuggling, and roleplay jailbreaks. These gaps can lead to system prompt leakage, unauthorized tool use, and indirect prompt injection through third-party data, which are difficult to contain after investor exposure.
A good workflow for AI security before demoing
Integrate security checks into the staging pipeline before any external access. Run a targeted scan against the demo environment using a standard profile, then a deep scan on endpoints that handle user input or model instructions. Review findings for prompt injection vectors, data exfiltration risks, and exposed internal instructions. Fix high-risk issues, re-scan to confirm resolution, and repeat this cycle on every significant change.
Example workflow using the CLI:
middlebrick scan https://staging.example.com --profile deep --output json
Use the JSON output to feed a dashboard or ticketing system, and block merges in CI when critical findings remain unresolved.
What middleBrick covers out of the box
middleBrick is a black-box API security scanner that maps findings to OWASP API Top 10 (2023), PCI-DSS 4.0, and SOC 2 Type II controls. For AI security, it runs 18 adversarial probes across three scan tiers, focusing on system prompt extraction, instruction override, DAN and roleplay jailbreaks, data exfiltration, cost exploitation, encoding bypasses, translation-embedded injection, few-shot poisoning, markdown injection, multi-turn manipulation, indirect prompt injection, token smuggling, tool abuse, nested instruction injection, and PII extraction.
The scanner supports OpenAPI 3.0, 3.1, and Swagger 2.0 with recursive $ref resolution, comparing spec definitions against runtime behavior to detect undefined security schemes or unexpected sensitive field exposure. Authenticated scanning is available with Bearer, API key, Basic auth, and cookies, protected by domain verification to ensure only the domain owner can run credentialed scans.
Next steps and limitations
Use middleBrick as a detection and reporting tool; it does not fix, patch, or block findings. It does not perform active SQL injection or command injection testing, does not detect business logic vulnerabilities, and does not replace a human pentester for high-stakes audits. Continuous monitoring and scheduled rescans can highlight new findings and score drift over time, but remediation requires manual investigation and code changes aligned with your risk tolerance.